CVE-2020-8177: 
Splunk Forwarder vulnerability analysis and mitigation

curl versions 7.20.0 through 7.70.0 contain a vulnerability that allows a malicious server to overwrite local files when using the -J (--remote-header-name) and -i (--include) command line options together (Curl Docs). The vulnerability was discovered on May 30, 2020 and publicly disclosed on June 24, 2020 (Curl Docs).

The vulnerability stems from a flaw in the command line tool's logic for handling the -J option, which saves remote files using filenames from Content-Disposition headers. While curl normally prevents overwriting existing local files, the check fails when -J and -i options are used in reverse order. This allows incoming HTTP headers to overwrite local files before the body data check occurs. The saved file would only contain response headers up until the first CRLF-CRLF sequence (Curl Docs).

A malicious server could exploit this vulnerability to overwrite local files with arbitrary header content when a user runs curl with the -J and -i options. The vulnerability only affects the curl command line tool and not applications using libcurl (Curl Docs).

The vulnerability requires a specific combination of command line options (-J and -i) to be used together, and only affects scenarios where curl is run in directories containing existing files. The issue was assigned a CVSS score of 7.8 (High) (NVD).

Users should upgrade to curl version 7.71.0 or later which contains the fix. Alternatively, users can avoid using the -J option in directories with existing files or apply the available patch to their current curl version. It is recommended to never run curl with the -J option in sensitive directories like $HOME (Curl Docs).